Threat actor · G1031

Saint Bear

Storm-0587TA471UAC-0056Lorec53

UnattributedNo public state or group attribution on record

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.

MITRE ATT&CK Techniques

T1027.002 T1027.013 T1059 T1059.001 T1059.003 T1059.007 T1112 T1203 T1204.001 T1204.002 T1497 T1553.002 T1566.001 T1583.006 T1589.002 T1608.001 T1684.001 T1685

Associated Malware

OutSteelSaint Bot

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.